Cross-device flow is when the user sits at a desktop and scans a QR code with the phone holding their wallet. Same-device flow is when they are already on the phone and a deep link opens the wallet. Both are OpenID4VP. Only the delivery differs.
Cross-device is the desktop case and needs a way for the result to reach the browser session that showed the QR, usually polling or a server-sent stream keyed to the session. Get this wrong and you get a page that never advances even though the wallet succeeded.
Same-device is simpler mechanically and harder in practice, because the user leaves your app for the wallet and has to come back. Return handling and session restoration are where these break.
A production integration needs both, picked by device detection, because people start signup on whatever is in front of them.
Defined in
OpenID4VP; ARF
If a wallet integration works in testing and falls over in production, this is usually why. Either the desktop session never hears back after the QR is scanned, or the user returns from the wallet app and lands in a session that no longer exists. Neither shows up when you test both halves on the same machine.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
